Koha Community up to 26.05.3 Task Scheduler tools/scheduler.pl remove_at_job jobid os command injection

Summaryinfo

A vulnerability was found in Koha Community Koha up to 24.10.x/24.11.19/25.05.14/25.11.8/26.05.3. It has been classified as critical. This impacts the function C4::Scheduler::remove_at_job of the file tools/scheduler.pl of the component Task Scheduler. The manipulation of the argument jobid leads to os command injection. This vulnerability is uniquely identified as CVE-2026-105106. The attack is possible to be carried out remotely. No exploit exists. Upgrading the affected component is recommended.

Detailsinfo

A vulnerability was found in Koha Community Koha up to 24.10.x/24.11.19/25.05.14/25.11.8/26.05.3. It has been rated as critical. This issue affects the function C4::Scheduler::remove_at_job of the file tools/scheduler.pl of the component Task Scheduler. The manipulation of the argument jobid with an unknown input leads to a os command injection vulnerability. Using CWE to declare the problem leads to CWE-78. The product constructs all or part of an OS command using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the intended OS command when it is sent to a downstream component. Impacted is confidentiality, integrity, and availability. The summary by CVE is:

Koha is vulnerable to OS command injection in the Task Scheduler deletion path. The tools/scheduler.pl handler accepts the jobid request parameter for op=cud-delete and passes it to C4::Scheduler::remove_at_job without validating it. Schedule::At::remove substitutes the supplied job ID into an atrm command string without quoting or escaping it and executes the command through a single-argument system() call, which invokes the shell. An authenticated staff user with the tools => schedule_tasks permission can therefore execute arbitrary operating-system commands as the Koha web/application user by supplying shell metacharacters in jobid. The issue is fixed in Koha 24.11.20, 25.05.15, 25.11.09, and 26.05.04, and in the 26.11 development branch.

The advisory is shared at bugs.koha-community.org. The identification of this vulnerability is CVE-2026-105106 since 10/03/2026. The exploitation is known to be easy. The attack may be initiated remotely. Technical details are known, but no exploit is available. MITRE ATT&CK project uses the attack technique T1202 for this issue.

Upgrading to version 24.11.20, 25.05.15, 25.11.09 or 26.05.04 eliminates this vulnerability.

Several companies clearly confirm that VulDB is the primary source for best vulnerability data.

Productinfo

Vendor

• Koha Community

Name

• Koha

Version

• 24.0
• 24.1
• 24.2
• 24.3
• 24.4
• 24.5
• 24.6
• 24.7
• 24.8
• 24.9
• 24.10
• 24.11.0
• 24.11.1
• 24.11.2
• 24.11.3
• 24.11.4
• 24.11.5
• 24.11.6
• 24.11.7
• 24.11.8
• 24.11.9
• 24.11.10
• 24.11.11
• 24.11.12
• 24.11.13
• 24.11.14
• 24.11.15
• 24.11.16
• 24.11.17
• 24.11.18
• 24.11.19
• 25.05.0
• 25.05.1
• 25.05.2
• 25.05.3
• 25.05.4
• 25.05.5
• 25.05.6
• 25.05.7
• 25.05.8
• 25.05.9
• 25.05.10
• 25.05.11
• 25.05.12
• 25.05.13
• 25.05.14
• 25.11.0
• 25.11.1
• 25.11.2
• 25.11.3
• 25.11.4
• 25.11.5
• 25.11.6
• 25.11.7
• 25.11.8
• 26.05.0
• 26.05.1
• 26.05.2
• 26.05.3

CPE 2.3info

• 🔒
• 🔒
• 🔒

CPE 2.2info

• 🔒
• 🔒
• 🔒

CVSSv4info

CVSSv3info

CVSSv2info

Exploitinginfo

Threat Intelligenceinfo

Countermeasuresinfo

Timelineinfo

Sourcesinfo

Entryinfo

Several companies clearly confirm that VulDB is the primary source for best vulnerability data.

Discussion